This vulnerability in Oracle Trading Community's Party Search UI component enables a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Oracle Trading Community. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with network attack vector, low attack complexity, and no user interaction required. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to remain on supported versions and apply patches without delay.

An attacker with low privileges and network access can gain unauthorized ability to create, delete, or modify critical data within Oracle Trading Community, potentially compromising confidentiality and integrity of all accessible data. This does not impact availability. The vulnerability poses a significant risk to data security within affected Oracle E-Business Suite environments.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability but strongly recommends applying Oracle Critical Patch Updates promptly. Organizations should monitor Oracle's official security alerts and apply relevant patches from the July 2026 Critical Patch Update or subsequent updates as soon as they become available. Until patched, restrict network access to Oracle Trading Community interfaces where possible.